Communication device, communication method, and program
By enabling the subsystem to handle authentication and event processing in a communication device, the main system's power-saving state transitions are minimized, reducing recovery time and power consumption during events like encryption key updates.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- RICOH CO LTD
- Filing Date
- 2022-06-20
- Publication Date
- 2026-05-15
AI Technical Summary
In communication systems like wireless LAN, the main system has to frequently transition from a power-saving state for encryption key update processes, leading to increased power consumption and inefficiency.
A communication device with a main system and a subsystem, where the subsystem performs authentication processes and event handling while the main system remains in a power-saving state, reducing the need for the main system to transition back to normal state for events like encryption key updates.
This approach reduces the time required for the main system to recover from a power-saving state due to events, thereby minimizing power consumption and improving efficiency.
Smart Images
Figure 0007859219000001 
Figure 0007859219000002 
Figure 0007859219000003
Abstract
Description
Technical Field
[0001] The present invention relates to a communication device, a communication method, and a program.
Background Art
[0002] In a communication device including a main system and a subsystem, a technique for reducing power consumption is known in which when the main system is in a power-saving state, the subsystem makes a proxy response on behalf of the main system.
[0003] For example, a normal data frame received in a wireless LAN (Local Area Network) communication is processed by the subsystem, and a data frame related to the update of an encryption key is processed by the main system after the subsystem wakes up the main system. This technique is known (see, for example, Patent Document 1).
Summary of the Invention
Problems to be Solved by the Invention
[0004] In the technique disclosed in Patent Document 1, for example, in a communication system such as a wireless LAN system in which an encryption key update process is executed at regular intervals, there is a problem that the main system has to return from the power-saving state every time the encryption key update process is performed.
[0005] One embodiment of the present invention has been made in view of the above problems, and in a communication device including a main system and a subsystem, for example, it reduces the main system's return from the power-saving state due to a predetermined event such as an encryption key update process.
Means for Solving the Problems
[0006] To solve the above problems, a communication device according to one embodiment of the present invention includes a main system capable of performing a first authentication process and a subsystem capable of performing a second authentication process, wherein the main system includes an authentication control unit that causes the main system or the subsystem to perform an authentication process for joining a network, and a power saving control unit that causes the main system to transition to a power saving state with less power consumption than the normal state in which the first authentication process can be performed, and the subsystem includes a communication unit that transmits and receives data via the network, and an event processing unit that processes a predetermined event related to connection to the network when the main system is in the power saving state, without transitioning the main system to the normal state. The authentication control unit causes the subsystem to execute the second authentication process, and the predetermined event includes an update process for the cryptographic key related to the second authentication process. [Effects of the Invention]
[0007] According to one embodiment of the present invention, in a communication device including a main system and a subsystem, it is possible to reduce the time it takes for the main system to recover from a power-saving state due to a predetermined event, such as an encryption key update process. [Brief explanation of the drawing]
[0008] [Figure 1] This figure shows an example of the hardware configuration of a communication device according to one embodiment. [Figure 2] This figure shows an example of the functional configuration of a communication device according to one embodiment. [Figure 3] This flowchart shows an example of processing by a communication device according to the first embodiment. [Figure 4] This is a flowchart showing an example of processing by a communication device according to the second embodiment. [Figure 5] This figure shows an example of the hardware configuration of a communication device according to the third embodiment. [Figure 6] This figure shows an example of the functional configuration of a communication device according to the third embodiment. [Figure 7]This is a flowchart showing an example of the processing of the event processing unit according to the third embodiment. [Figure 8] This is a flowchart showing an example of a processing control unit according to the third embodiment. [Modes for carrying out the invention]
[0009] Embodiments of the present invention will be described in detail below with reference to the drawings.
[0010] <Example of communication device configuration> Figure 1 shows an example of the hardware configuration of a communication device according to one embodiment. The communication device 100 is an information processing device or an electronic device, etc. The communication device 100 is connected to a network 103, such as a wireless LAN (Local Area Network). Furthermore, the communication device 100 has multiple power consumption states. These multiple power consumption states include, for example, a normal state in which a predetermined function can be performed and a power-saving state in which power consumption is lower than that of the normal state. Furthermore, the communication device 100 is an information processing device or an electronic device, etc., that has a power-saving function that allows it to transition between the normal state and the power-saving state.
[0011] The communication device 100 may include various devices connected to the network 103 that have the aforementioned power-saving functions. For example, the communication device 100 may be an image forming device such as a printer or MFP (Multifunction Peripheral), a PJ (Projector), an IWB (Interactive White Board: an electronic whiteboard with mutual communication capabilities), or other electronic devices. The communication device 100 may also be an output device such as a digital signage display, a HUD (Head Up Display) device, industrial machinery, an imaging device, a sound collection device, medical equipment, networked home appliances, an automobile (Connected Car), an in-vehicle device, etc. Furthermore, the communication device 100 may also be a notebook PC (Personal Computer), a mobile phone, a smartphone, a tablet device, a game console, a PDA (Personal Digital Assistant), a digital camera, a wearable PC, or a desktop PC, etc.
[0012] As shown in Figure 1, the communication device 100 includes a subsystem 110 and a main system 120. The subsystem 110 transmits and receives data via the network 103. The subsystem 110 includes, for example, a sub-CPU (Central Processing Unit) 111, subsystem memory 112, wireless LAN module 113, signal output circuit 114, and bus 115.
[0013] The sub-CPU 111 is a processor (arithmetic unit) that controls the subsystem 110 by executing a predetermined program stored in, for example, the subsystem memory 112.
[0014] The subsystem memory 112 includes a volatile memory, the RAM (Random Access Memory) 112-A, and a non-volatile memory, the ROM (Read Only Memory) 112-B, etc. The RAM 112-A is used, for example, as a work area of the sub CPU 111. The ROM 112-B stores in advance a predetermined program including a startup program, etc. Also, the subsystem memory 112 may include a storage device such as an SSD (Solid State Drive), or a flash ROM, etc.
[0015] The wireless LAN module 113 is a device that transmits and receives data via the network 103. The wireless LAN module 113 includes, for example, a wireless section that transmits and receives wireless signals, an antenna, and a MAC (Media Access Control) controller, etc.
[0016] The signal output circuit 114 is a circuit that outputs a return request signal, etc. that requests the main system 120 to return from the power-saving state according to the control from the sub CPU 111. The bus 115 is connected to each component of the subsystem 110 and transmits, for example, an address signal, a data signal, and various control signals, etc.
[0017] The main system 120 includes, for example, a main CPU 121, a main system memory 122, a power control circuit 123, and a bus 124, etc. The main system 120 executes various functions (for example, image formation processing, output processing, or display processing, etc.) provided in the communication device 100.
[0018] The main CPU 121 is a processor (arithmetic unit) that controls the main system 120, for example, by executing a predetermined program stored in the main system memory 122.
[0019] The main system memory 122 includes, for example, a RAM 122-A which is a volatile memory, a ROM 122-B which is a non-volatile memory, and the like. The RAM 122-A is used as a work area for the main CPU 121. Also, the ROM 122-B stores in advance a predetermined program including a startup program for the main CPU 121 and the like. Further, the main system memory 122 may include, for example, a storage device such as an SSD or a flash ROM.
[0020] The power control circuit 123 controls the supply of power into the main system 120. For example, when the main system 120 (or the communication device 100) shifts to a power-saving state, the power control circuit 123 stops the supply of power into the main system 120. Also, when in the power-saving state, upon receiving a return request signal requesting a return to normal operation from the subsystem 110, the power control circuit 123 resumes the supply of power into the main system 120. Note that power is constantly supplied to the power control circuit 123 even when the main system 120 is in the power-saving state in the communication device 100. The bus 124 is commonly connected to each component of the main system 120 and transmits, for example, an address signal, a data signal, and various control signals.
[0021] The subsystem 110 and the main system 120 are connected by a communication interface such as a high-speed serial I / F (Interface) 101. Note that the interface connecting the subsystem 110 and the main system 120 may be a communication interface other than the high-speed serial interface.
[0022] In the normal state, the communication device 100 starts both the main system 120 and the subsystem. The communication device 100 performs its functions under the control of the main system 120. On the other hand, in the power-saving state, the communication device 100 starts only the subsystem 110, without starting the main system 120. The main system 120 has higher processing power than the subsystem 110. However, the main system 120 also consumes more power than the subsystem 110. Therefore, in the power-saving state, the power consumption of the communication device 100 can be significantly reduced compared to the normal state.
[0023] <Functional Configuration> Figure 2 shows an example of the functional configuration of a communication device 100 according to one embodiment. The communication device 100 includes a main system 120 capable of performing a first authentication process and a subsystem 110 capable of performing a second authentication process. The first authentication process is an authentication process using an authentication method that requires processing related to an electronic certificate. An authentication method that requires processing related to an electronic certificate includes, for example, WPA-Enterprise authentication. The second authentication process is an authentication process using an authentication method that does not require processing related to an electronic certificate. An authentication method that does not require processing related to an electronic certificate includes, for example, open authentication or WPA2-PSK authentication.
[0024] (System Functional Configuration) The subsystem 110 implements, for example, a communication unit 201, an event processing unit 202, a sub-response unit 203, a state control unit 204, and a sub-authentication unit 205, by having the sub-CPU 111 read and execute a predetermined program stored in the subsystem memory 112. At least some of the above functional configurations may be implemented by hardware.
[0025] The communication unit 201 performs communication processing, for example, using the wireless LAN module 113, to send and receive data via the network 103.
[0026] The event processing unit 202 analyzes the data frame received by the communication unit 201 and identifies the processing unit (sub-response unit 203, sub-authentication unit 205, or processing control unit 212, etc.) that will process the data frame. The event processing unit 202 then forwards the received data frame to the identified processing unit. For example, if the main system 120 is in a normal state, the event processing unit 202 forwards the received data frame to the processing control unit 212 of the main system 120. Note that data frames are sometimes called packets.
[0027] Furthermore, if the main system 120 is in a power-saving state, the event processing unit 202 determines whether the received data frame can be processed by the subsystem 110. Details of this determination will be described later. If the event processing unit 202 determines that the received data frame cannot be processed by the subsystem 110, the event processing unit 202 uses the state control unit 204 to transition the main system 120 to the normal state. After the event processing unit 202 transitions the main system 120 to the normal state, the event processing unit 202 transfers the received data frame to the processing control unit 212 of the main system 120.
[0028] On the other hand, if the main system 120 is in a power-saving state and the event processing unit 202 determines that the received data frame can be processed by the subsystem 110, the event processing unit 202 forwards the received data frame to the sub-authentication unit 205 or the sub-response unit 203, depending on the type of data frame received. For example, if the type of received data frame is related to authentication processing such as network connection processing or encryption key update processing, the event processing unit 202 forwards the received data frame to the sub-authentication unit 205. On the other hand, if the type of received data frame is not related to authentication processing, the event processing unit 202 forwards the received data frame to the sub-response unit 203.
[0029] The sub-response unit 203 processes the data frame received from the event processing unit 202 within the subsystem 110 and creates response data corresponding to the received data frame. The sub-response unit 203 also creates a data frame containing the created response data and returns it to the event processing unit 202. The data frame processed by the sub-response unit 203 may include information that can be pre-stored in the subsystem memory 112, such as request data querying the status, device name, unique identification number, or functions of the communication device 100. For example, RAM 112-A stores the status of the communication device 100, and ROM 112-A stores the device name, unique identification number, or functions.
[0030] The state control unit 204, in accordance with the control from the event processing unit 202, sends a return request signal to the power control circuit 123 of the main system 120, thereby returning (transitioning) the main system 120 from the power-saving state to the normal state.
[0031] The sub-authentication unit (second authentication unit) 205 performs a second authentication process using an authentication method that can be executed within subsystem 110. The second authentication process performs processes such as connecting to a wireless LAN access point or updating encryption keys, using an authentication method that does not require processing related to digital certificates, such as open authentication or WPA2-PSK.
[0032] (Main system functional configuration) The main system 120 implements, for example, an authentication control unit 211, a processing control unit 212, a main response unit 213, a main authentication unit 214, a certificate management unit 215, a communication control unit 216, a storage unit 217, and a power saving control unit 218, by having the main CPU 121 read and execute a predetermined program stored in the main system memory 122. At least some of the above functional configurations may be implemented by hardware.
[0033] The authentication control unit 211 causes the main system 120 or subsystem 110 to perform authentication processing for joining the network 103. For example, the authentication control unit 211 causes the main authentication unit 214 or sub-authentication unit 205 to perform connection processing with the access point, according to the authentication method set in the communication device 100 stored in the main system memory 122, etc. As an example, if the authentication method stored in the storage unit 217 is an authentication method that does not require processing related to digital certificates, the authentication control unit 211 causes the subsystem 110 to perform authentication processing for joining the network. On the other hand, if the authentication method stored in the main system memory 122 is an authentication method that requires processing related to digital certificates, the authentication control unit 211 causes the main system 120 to perform authentication processing for joining the network 103. Authentication methods that do not require processing related to digital certificates include, for example, open authentication or WPA2-PSK authentication. Authentication methods that require processing related to digital certificates include, for example, WPA-Enterprise authentication.
[0034] The processing control unit 212 instructs the processing unit corresponding to the data frame received from the event processing unit 202 to execute the data frame. For example, if the received data frame is related to authentication processing, the processing control unit 212 forwards the data frame to the main authentication unit 214. If the received data frame is not related to authentication processing, the processing control unit 212 forwards the data frame to the main response unit 213.
[0035] Furthermore, when the processing control unit 212 receives a response frame for a transferred data frame from the main authentication unit 214 or the main response unit 213, it forwards the response frame to the event processing unit.
[0036] The main response unit 213 creates a response frame in response to the data frame received from the processing control unit 212, and sends the created response frame back to the processing control unit 212.
[0037] The main authentication unit (first authentication unit) 214 performs the first authentication process using an authentication method that requires processing related to electronic certificates, such as WPA-Enterprise authentication. For example, the main authentication unit 214 uses the communication control unit 216 to control the communication unit 201 and performs processes such as connecting to a wireless LAN access point and updating encryption keys.
[0038] For example, if the wireless LAN authentication method is WPA2-Enterprise using EAP-TLS, the main authentication unit 214 verifies the server certificate using the CA (Certification Authority) certificate read from the main system memory 122, etc. The main authentication unit 214 also sends the client certificate read from the main system memory 122, etc., performs mutual authentication, and generates a pre-shared key. Furthermore, the main authentication unit 214 uses the generated pre-shared key to perform a 4-way handshake and complete the authentication process. A 4-way handshake is a common procedure for exchanging encryption keys in wireless LAN systems, etc.
[0039] The certificate management unit 215 stores and manages the aforementioned CA certificates and client certificates and other electronic certificates in the main system memory 122. The communication control unit 216 is an interface used by the main authentication unit 214 to control the communication unit 201 from the main system 120.
[0040] The memory unit 217 is implemented, for example, by a program executed by the main CPU 121 and the main system memory 122. The memory unit 217 stores various data (or information), such as the aforementioned digital certificates, encryption keys such as pre-shared keys, and authentication method setting information, in the main system memory 122.
[0041] The power saving control unit 218 is implemented, for example, by a program executed by the main CPU 121 and the power control circuit 123, and transitions the main system 120 to a power saving state at a predetermined timing. The predetermined timing is, for example, after the main system 120 or subsystem 110 has performed authentication processing to join the network 103, or when the idle state continues for a predetermined time or longer. The power saving control unit 218 may also be activated first when the power control circuit 123 starts supplying power to the main system 120 in response to a return request signal transmitted from subsystem 110, and may then activate other processing units.
[0042] <Processing flow> Next, the processing flow of the communication method according to this embodiment will be described.
[0043] [First Embodiment] Figure 3 is a flowchart showing an example of the processing of the communication device 100 according to the first embodiment. Here, we will mainly explain the authentication processing performed by the sub-authentication unit 205 and the main authentication unit 214 among the various processes performed by the communication device 100.
[0044] In step S301, the main system 120 and subsystem 110 are started. At this time, the event processing unit 202 of subsystem 110 disables the processing (connection management) by the sub-authentication unit 205. The connection management setting is stored in subsystem memory 112 by the event processing unit 202, for example.
[0045] In step S302, the authentication control unit 211 of the main system 120 reads the authentication method set for the communication device 100 from the main system memory 122. In step S303, the authentication control unit 211 of the main system 120 determines whether the read authentication method is an authentication method that can be processed by the sub-authentication unit 205. For example, if the authentication method set for the communication device 100 is an authentication method that does not require processing related to electronic certificates, the authentication control unit 211 determines that it is an authentication method that can be processed by the subsystem 110. On the other hand, if the authentication method set for the communication device 100 is an authentication method that requires processing related to electronic certificates, the authentication control unit 211 determines that it is an authentication method that cannot be processed by the subsystem 110. Authentication methods that do not require processing related to electronic certificates include, for example, open authentication or WPA2-PSK authentication. On the other hand, authentication methods that require processing related to electronic certificates include, for example, WPA2-Enterprise authentication.
[0046] If the authentication control unit 211 determines that the subsystem 110 can process the request, the authentication control unit 211 moves the process to step S304. On the other hand, if the authentication control unit 211 determines that the subsystem 110 cannot process the request, the authentication control unit 211 moves the process to step S321.
[0047] When the process moves to step S304, the authentication control unit 211 of the main system 120 activates the sub-authentication unit 205 of the subsystem 110. At this time, the authentication control unit 211 sets the passphrase read from the main system memory 122 into the sub-authentication unit 205. The passphrase is used to generate a pre-shared key. The passphrase is composed of, for example, a combination of strings and numbers. The passphrase may also be, for example, a password of 10 characters or less. The passphrase is set, for example, by a user or administrator and stored in the main system memory 122.
[0048] In step S305, the sub-authentication unit 205 of subsystem 110 starts the authentication process for joining (connecting to) network 103. At this time, the sub-authentication unit 205 processes a data frame for key exchange according to the authentication method, or an event specific to the wireless LAN. For example, if the authentication method is WPA2-PSK, the sub-authentication unit 205 generates a pre-shared key based on the passphrase set by the authentication control unit 211 and performs a 4-way handshake. Joining (connecting to) network 103 includes, for example, a wireless connection to an external access point.
[0049] In step S306, once the authentication process by the sub-authentication unit 205 is completed, in step S307, the power saving control unit 218 of the main system 120 switches the main system 120 to a power saving state. Once the main system 120 is in a power saving state, the subsystem 110 executes subsystem process 1 as shown in steps S308 to S311.
[0050] In step S308, the main system 120 is turned off (power saving state). At this time, the event processing unit 202 of the subsystem 110 enables processing by the sub-authentication unit 205 (connection management).
[0051] In steps S309 and S310, when a predetermined event related to the connection to the network 103 occurs, the event processing unit 202 starts processing the predetermined event within the subsystem 110 without returning the main system 120 to the normal state. For example, when the communication unit 201 receives a data frame for key exchange, the event processing unit 202 forwards the received data frame to the sub-authentication unit 205. The reception of a data frame for key exchange is just one example of a predetermined event.
[0052] Furthermore, when the sub-authentication unit 205 receives a data frame for key exchange from the event processing unit 202, it executes the cryptographic key update process.
[0053] In step S311, once the processing by the sub-authentication unit 205 is completed, the event processing unit 202 returns to step S309 and waits for the occurrence of a predetermined event.
[0054] As a result of the above processing, if the authentication method set in the communication device 100 is an open authentication method or an authentication method that does not require processing related to electronic certificates, such as WPA2-PSK authentication, the communication device 100 can process predetermined events, such as cryptographic key update processing, within the scope of subsystem 110.
[0055] On the other hand, when the system moves from step S303 to step S321, the authentication control unit 211 of the main system 120 activates the main authentication unit 214 of the main system 120.
[0056] In step S322, the main authentication unit 214 of the main system 120 starts the authentication process for joining (connecting to) the network 103. At this time, the main authentication unit 214 processes a data frame for key exchange according to the authentication method, or an event specific to the wireless LAN. For example, if the authentication method is WPA2-Enterprise using EAP-TLS, the main authentication unit 214 verifies the server certificate using the CA certificate read from the main system memory 122. The main authentication unit 214 also sends the client certificate read from the main system memory 122 to perform mutual authentication and generate a pre-shared key. Furthermore, the main authentication unit 214 performs a 4-way handshake using the generated pre-shared key. Note that joining (connecting to) the network 103 includes, for example, a wireless connection to an external access point.
[0057] In step S323, once the authentication process by the main authentication unit 214 is completed, in step S324, the power saving control unit 218 of the main system 120 switches the main system 120 to a power saving state. Once the main system 120 switches to the power saving state, the subsystem 110 executes subsystem processing 2 as shown in steps S325 to S327.
[0058] In step S325, the main system 120 is turned off (power saving state). At this time, the event processing unit 202 of the subsystem 110 maintains a state in which processing by the sub-authentication unit 205 (connection management) is disabled.
[0059] In step S326, when a predetermined event related to connecting to the network 103 occurs, the event processing unit 202, in step S327, uses the state control unit 204 to request the main system 120 to return to the normal state.
[0060] In step S328, the main system 120 is turned on (normal state). At this time, the event processing unit 202 of the subsystem 110 maintains a state in which processing by the sub-authentication unit 205 (connection management) is disabled. Preferably, the event processing unit 202 sets processing by the sub-response unit 203 (proxy response) to be disabled. The proxy response setting is stored in the subsystem memory 112 by the event processing unit 202, for example.
[0061] In step S329, when the main system 120 returns to its normal state, the main system 120 proceeds to step S322. For example, the event processing unit 202 of subsystem 110 forwards the data frame for key exchange received by the communication unit 201 to the main authentication unit 214 via the processing control unit 212 of the main system 120.
[0062] In this case, the main authentication unit 214 of the main system 120 performs an encryption key update process in step S322 according to the data frame for key exchange received from the processing control unit 212.
[0063] Through the above process, the communication device 100 can execute processing using the main system 120 even when the authentication method set in the communication device 100 is an authentication method that requires processing related to digital certificates, such as WPA2-Enterprise using EAP-TLS. The first authentication process that the main system 120 executes, which requires processing related to digital certificates, is an example of a predetermined function that the communication device 100 can execute under normal conditions.
[0064] [Second Embodiment] In the second embodiment, an example of the process when the authentication information of the main authentication unit 214 is shared with the sub-authentication unit 205 will be described.
[0065] Figure 4 is a flowchart illustrating an example of the processing of a communication device according to the second embodiment. Note that steps S301-S307 and S420 of the processing shown in Figure 4 are the same as the processing of the first embodiment described in Figure 3, and therefore their explanation is omitted here. In step S420 of Figure 4, the communication device 100 executes subsystem processing 1 as shown in steps S308-S311 of Figure 3. Furthermore, a detailed explanation of the processing similar to that of the first embodiment is omitted here.
[0066] When the system moves from step S303 to step S401, the authentication control unit 211 of the main system 120 activates the main authentication unit 214 of the main system 120.
[0067] In step S402, the main authentication unit 214 of the main system 120 starts the authentication process to join (connect to) the network 103. This process can be the same as the process in step S322 in Figure 3.
[0068] In step S403, once the authentication process by the main authentication unit 214 is completed, in step S404, the authentication control unit 211 of the main system 120 shares the results of the authentication process by the main authentication unit 214 with the sub-authentication unit 205 of the subsystem 110. For example, the authentication control unit 211 activates the sub-authentication unit 205 and notifies the sub-authentication unit 205 of authentication information such as the pre-shared key and data frame encryption key generated in the authentication process of step S402.
[0069] In step S405, the power saving control unit 218 of the main system 120 transitions the main system 120 to a power saving state. Once the main system 120 is in a power saving state, the subsystem 110 executes subsystem processing 3 as shown in steps S406 to S411.
[0070] In step S406, the main system 120 is turned off (power saving state). At this time, the event processing unit 202 of the subsystem 110 sets the processing by the sub-authentication unit 205 (connection management) to an enabled state.
[0071] In step S407, when a predetermined event related to connecting to the network 103 occurs, the event processing unit 202 proceeds to step S408.
[0072] When the process moves to step S408, the event processing unit 202 determines whether the predetermined event that occurred can be processed by the subsystem. For example, if the event that occurred is the reception of a data frame for key exchange and the cryptographic key update does not involve processing related to digital certificates, the event processing unit 202 determines that the event can be processed by the subsystem.
[0073] In the second embodiment, since the sub-authentication unit 205 has already shared authentication information with the main authentication unit 214, it determines that even if the authentication method is WPA2-Enterprise and the event that occurs is the reception of a data frame for key exchange, it can be processed within the subsystem 110.
[0074] When the authentication method is WPA2-Enterprise, the encryption key is updated using a 4-way handshake. This process uses the same algorithm as key exchange in WPA2-PSK and does not involve processes that would require restoring the main system 120, such as server certificate verification.
[0075] If the event that occurred can be processed by the subsystem, the event processing unit 202 moves the processing to step S409. On the other hand, if the event that occurred cannot be processed by the subsystem, the event processing unit 202 moves the processing to step S411.
[0076] When the process moves to step S409, the sub-authentication unit 205 begins processing the data frame received from the event processing unit 202. For example, when the sub-authentication unit 205 receives a data frame for key exchange from the event processing unit 202, it performs a 4-way handshake using the previously shared key and the data frame encryption key to obtain a new data frame encryption key.
[0077] In step S410, once the processing by the sub-authentication unit 205 is completed, the event processing unit 202 returns to step S407 and waits again for the occurrence of a predetermined event.
[0078] On the other hand, when the system moves from step S408 to step S411, the event processing unit 202 uses the state control unit 204 to request the main system 120 to return to the normal state.
[0079] In step S412, the main system 120 is turned on (normal state). At this time, the event processing unit 202 of the subsystem 110 disables the processing (connection management) by the sub-authentication unit 205. Preferably, the event processing unit 202 disables the processing (proxy response) by the sub-response unit 203.
[0080] In step S413, when the main system 120 returns to its normal state, the main system 120 proceeds to step S402. For example, the event processing unit 202 of subsystem 110 forwards the data frame for key exchange received by the communication unit 201 to the main authentication unit 214 via the processing control unit 212 of the main system 120.
[0081] In this case, in step S402, the main authentication unit 214 of the main system 120 receives a data frame for key exchange from the processing control unit 212 and executes the encryption key update process. Also, in step S404, the main authentication unit 214 updates the authentication information shared with the sub-authentication unit 205.
[0082] Through the above processing, the communication device 100 according to the second embodiment can process predetermined events, such as cryptographic key update processing, within the scope of the subsystem 110, even when the configured authentication method is WPA2-Enterprise.
[0083] [Third Embodiment] In the third embodiment, an example of processing will be described when the communication device 100 is an image forming apparatus, which is an example of an electronic device.
[0084] <Hardware Configuration> Figure 5 shows an example of the hardware configuration of a communication device according to the third embodiment. As shown in Figure 5, the communication device 100 according to the third embodiment has an engine control unit 500 in addition to the hardware configuration of the communication device 100 according to the first embodiment shown in Figure 1.
[0085] The engine control unit 500 includes, for example, a printer 501 and a scanner 502. The printer 501 is a printing device that prints print data onto a printing medium. The scanner 502 is a reading device that reads documents and the like. The engine control unit 500 controls the printer 501 and the scanner 502 according to instructions from the main system 120.
[0086] <Functional Configuration> Figure 6 shows an example of the functional configuration of a communication device according to the third embodiment. As shown in Figure 6, the communication device 100 according to the third embodiment has an image forming processing unit 601 in addition to the functional configuration of the communication device 100 according to the first embodiment shown in Figure 2.
[0087] The image forming processing unit 601 is implemented, for example, by the main CPU 121 reading and executing a predetermined program stored in the main system memory 122. The image forming processing unit 601 controls the engine control unit 500 according to the received image processing request to perform image forming processing such as printing, reading, copying.
[0088] <Processing flow> (Event processing) Figure 7 is a flowchart showing an example of the processing of the event processing unit according to the third embodiment. This process shows an example of the processing that the event processing unit 202 executes when the communication unit 201 of subsystem 110 receives a data frame.
[0089] In step S701, when the communication unit 201 receives a data frame (hereinafter referred to as the request data), the event processing unit 202 executes the processing from step S702 onward.
[0090] In step S702, the event processing unit 202 determines whether the main system 120 is in a power-saving state. If the main system 120 is not in a power-saving state, the event processing unit 202 proceeds to step S705. On the other hand, if the main system 120 is in a power-saving state, the event processing unit 202 proceeds to step S703.
[0091] In step S703, the event processing unit 202 determines whether the request data received by the communication unit 201 can be processed by the subsystem 110. The request data that can be processed by the subsystem 110 includes, for example, authentication request data that can be processed by the sub-authentication unit 205, and inquiry request data that can be responded to by the sub-response unit 203. If the request data received by the communication unit 201 cannot be processed by the subsystem 110, the event processing unit 202 moves the process to step S704. On the other hand, if the request data received by the communication unit 201 can be processed by the subsystem 110, the event processing unit 202 moves the process to step S706.
[0092] When the process moves to step S704, the event processing unit 202 uses the state control unit 204 to restore the main system 120 to its normal state.
[0093] When the process moves to step S705, the event processing unit 202 forwards the request data received by the communication unit 201 to the processing control unit 212 of the main system 120.
[0094] On the other hand, when the process moves from step S703 to step S706, the event processing unit 202 determines whether the request data received by the communication unit 201 is request data related to authentication processing. If the request data received by the communication unit 201 is request data related to authentication processing, the event processing unit 202 moves the process to step S707. On the other hand, if the request data received by the communication unit 201 is not request data related to authentication processing, the event processing unit 202 moves the process to step S708.
[0095] When the process moves to step 707, the event processing unit 202 transfers the request data to the sub-authentication unit 205. The event processing unit 202 may also determine, for example, that a predetermined event has occurred in step S309 of Figure 3 when it performs this process.
[0096] When the process moves to step S708, the event processing unit 202 transfers the request data to the sub-response unit 203. The sub-response unit 203 then creates, for example, a data frame in response to the request data (hereinafter referred to as response data) and notifies the event processing unit 202 of the created response data.
[0097] In step S709, the event processing unit 202 determines whether or not it has received response data from the destination to which the request data was transferred. If it has not received response data, the event processing unit 202 terminates the process shown in Figure 7. On the other hand, if it has received response data, the event processing unit 202 proceeds to step S710.
[0098] When the process moves to step S710, the event processing unit 202 uses the communication unit 201 to send the received response data back to the source of the request data.
[0099] (Processing by the processing control unit) Figure 8 is a flowchart showing an example of processing by the processing control unit according to the third embodiment. This process shows an example of the processing that the processing control unit 212 of the main system 120 executes when it receives request data from the event processing unit 202 of the subsystem 110.
[0100] In step S801, when the processing control unit 212 receives request data from the event processing unit 202 of the subsystem 110, the processing control unit 212 executes the processing from step S802 onward.
[0101] In step S802, the processing control unit 212 determines whether the received request data is a request data related to authentication processing. If the received request data is a request data related to authentication processing, the processing control unit 212 moves the process to step S803. On the other hand, if the received request data is not a request data related to authentication processing, the processing control unit 212 moves the process to step S804.
[0102] When the process moves to step S803, the processing control unit 212 transfers the request data to the main authentication unit 214. If this request data is, for example, a data frame for key exchange, the main authentication unit 214 performs the cryptographic key update process.
[0103] On the other hand, when the process moves from step S802 to step S804, the processing control unit 212 determines whether the requested data is a requested data relating to image formation processing. If the requested data is a requested data relating to image formation processing, the processing control unit 212 moves the process to step S805. On the other hand, if the requested data is not a requested data relating to image formation processing, the processing control unit 212 moves the process to step S806.
[0104] When the process moves to step S805, the processing control unit 212 transfers the request data to the image forming processing unit 601. Based on the request data, the image forming processing unit 601 executes the requested image forming process. The image forming processing unit 601 also creates response data in response to the request data and notifies the processing control unit 212 of the created response data.
[0105] When the process moves to step S806, the processing control unit 212 transfers the request data to the main response unit 213. The main response unit 213 then performs the necessary processing, for example, to create response data in response to the request data, and notifies the processing control unit 212 of the created response data.
[0106] In step S807, the processing control unit 212 determines whether or not it has received response data from the destination to which the request data was transferred. If it has not received response data, the processing control unit 212 terminates the process shown in Figure 8. On the other hand, if it has received response data, the processing control unit 212 proceeds to step S808.
[0107] When the process moves to step S808, the processing control unit 212 transfers the received response data to the event processing unit 202 of subsystem 110.
[0108] As shown in Figures 8 and 9, the communication device 100 can perform the processing of the communication device 100 according to the first and second embodiments, and when it receives data requesting image formation processing, it can return the main system 120 to its normal state and execute the image formation processing. The image formation processing performed by the main system 120 is just another example of a predetermined function that the communication device 100 can perform in its normal state.
[0109] As described above, according to each embodiment of the present invention, in a communication device 100 including a main system 120 and a subsystem 110, it is possible to reduce the time it takes for the main system to recover from a power-saving state due to a predetermined event, such as an encryption key update process.
[0110] It should be noted that the above embodiments are merely examples, and the communication device 100 can be modified or applied in various ways. For example, the communication device 100 according to the third embodiment may be any electronic device other than an image forming apparatus. For example, if the communication device 100 is a projector, the communication device 100 may be configured to have an image projection unit instead of the engine control unit 500 in Figure 5, and an image projection unit instead of the image forming processing unit 601 in Figure 6.
[0111] Furthermore, in the first to third embodiments, the event processing unit 202, implemented by a program executed by the sub-CPU 111, determines the destination of the received data frame. However, this is just one example, and the subsystem 110 may also have a filter unit (hardware) that analyzes the received data frame and distributes it while discarding unnecessary data frames.
[0112] Furthermore, while the first to third embodiments described an example of connecting to the network 103 using a wireless LAN module 113, the communication device 100 may also connect to the network 103 using a NIC (Network Interface Card).
[0113] <Note> This specification discloses communication devices, communication methods, and programs as described in the following sections. (Section 1) A communication device comprising a main system capable of performing a first authentication process and a subsystem capable of performing a second authentication process, The aforementioned main system is An authentication control unit that causes the main system or subsystem to perform authentication processing for joining the network, A power saving control unit that causes the main system to switch to a power saving state with lower power consumption than the normal state in which the first authentication process can be executed, It has, The subsystem described above is A communication unit that sends and receives data via the aforementioned network, When the main system is in the power-saving state, if a predetermined event related to connecting to the network occurs, an event processing unit processes the predetermined event without returning the main system to the normal state. A communication device having the following features. (Section 2) The authentication control unit causes the subsystem to execute the second authentication process. The aforementioned predetermined event includes an update process for the cryptographic key related to the second authentication process, The communication device described in paragraph 1. (Section 3) The second authentication process is performed by the communication device described in paragraph 1 or 2, which performs an encryption key update process using an authentication method that does not require processing related to electronic certificates. (Section 4) The authentication control unit causes the main system to execute the first authentication process. The main system shares the authentication information created in the first authentication process with the subsystem. The aforementioned predetermined event includes an update process for the cryptographic key related to the first authentication process, The communication device described in paragraph 1. (Section 5) The aforementioned authentication information includes a pre-shared key and a data frame encryption key, as described in paragraph 4 of the communication device. (Section 6) The communication device according to any one of paragraphs 1 to 5, wherein the subsystem has a state control unit that transitions the main system to the normal state when an event occurs that cannot be processed by the subsystem while the main system is in the power-saving state. (Section 7) The power saving control unit is a communication device according to any one of paragraphs 1 to 6, which causes the main system to switch to the power saving state after the main system or the subsystem has performed an authentication process to join the network. (Section 8) The aforementioned network includes a wireless LAN network and is a communication device as described in any of paragraphs 1 to 7. (Section 9) A communication method performed by a communication device including a main system capable of performing a first authentication process and a subsystem capable of performing a second authentication process, The aforementioned main system The steps include causing the main system or subsystem to perform an authentication process for joining the network, The steps include: transitioning the main system to a power-saving state that consumes less power than the normal state in which the first authentication process can be executed; Execute, The subsystem is The steps include sending and receiving data via the aforementioned network, When the main system is in the power-saving state and a predetermined event related to connecting to the network occurs, the step of processing the predetermined event without returning the main system to the normal state is: A communication method for executing this. (Section 10) A program executed by a communication device including a main system capable of performing a first authentication process and a subsystem capable of performing a second authentication process, In the aforementioned main system, The steps include causing the main system or subsystem to perform an authentication process for joining the network, The steps include: transitioning the main system to a power-saving state that consumes less power than the normal state in which the first authentication process can be executed; Make it run, In the subsystem mentioned above, The steps include sending and receiving data via the aforementioned network, When the main system is in the power-saving state and a predetermined event related to connecting to the network occurs, the step of processing the predetermined event without returning the main system to the normal state is: A program that executes something. (Section 11) A communication device including a main system and subsystems, A network interface that connects to a wireless network, A storage unit that stores the settings of one authentication method used by the communication device to connect to the wireless network, from among the multiple authentication methods for connecting to the wireless network, which include an authentication method that requires processing related to an electronic certificate and an authentication method that does not require processing related to an electronic certificate. It has, The aforementioned main system is A power-saving control unit, at a predetermined timing, switches the main system to a power-saving state that consumes less power than the normal state. It has, The subsystem described above is When the main system is in the power-saving state and receives a data frame for cryptographic key exchange via the wireless network, an event processing unit causes the main system or the subsystem to perform cryptographic key exchange based on the data frame. It has, If the setting of the first authentication method configured in the storage unit is an authentication method that does not require processing related to electronic certificates, the event processing unit causes the subsystem to perform a key exchange of the encryption key based on the received data frame. If the setting of the first authentication method configured in the storage unit is an authentication method that requires processing related to electronic certificates, the event processing unit transitions the main system from the power-saving state to the normal state, transmits the received data frame to the main system, and causes the main system to perform a key exchange of the encryption key based on the received data frame. Communication device. (Section 12) The aforementioned main system is A first authentication unit that executes a process related to key exchange of cryptographic keys based on the data frame transmitted from the event processing unit. It further possesses, The subsystem described above is A second authentication unit that executes a process related to key exchange of the cryptographic key based on the received data frame. A communication device as described in paragraph 11, further comprising the following:
[0114] Although embodiments of the present invention have been described above, the present invention is not limited to these specific embodiments, and various modifications and applications are possible within the scope of the gist of the present invention as described in the claims. [Explanation of Symbols]
[0115] 100 Communication devices 103 Network 110 subsystems 120 Main System 201 Communications Department 202 Event Processing Unit 204 State Control Unit 205 Sub-authentication section (second authentication section) 211 Authentication Control Unit 212 Processing Control Unit 214 Main Authentication Unit (First Authentication Unit) 217 Memory section 218 Power saving control unit [Prior art documents] [Patent Documents]
[0116] [Patent Document 1] Japanese Patent Publication No. 2017-050601
Claims
1. A communication device comprising a main system capable of performing a first authentication process and a subsystem capable of performing a second authentication process, The aforementioned main system is An authentication control unit that causes the main system or subsystem to perform authentication processing for joining the network, A power saving control unit that transitions the main system to a power saving state that consumes less power than the normal state in which the first authentication process can be executed, It has, The subsystem described above is A communication unit that sends and receives data via the aforementioned network, When the main system is in the power-saving state, if a predetermined event related to connecting to the network occurs, an event processing unit processes the predetermined event without returning the main system to the normal state. It has, The authentication control unit causes the subsystem to execute the second authentication process. The aforementioned predetermined event includes an update process for the cryptographic key related to the second authentication process, Communication device.
2. The communication device according to claim 1, wherein the second authentication process performs an encryption key update process using an authentication method that does not require processing related to an electronic certificate.
3. The authentication control unit causes the main system to execute the first authentication process. The main system shares the authentication information created in the first authentication process with the subsystem. The aforementioned predetermined event includes an update process for the cryptographic key related to the first authentication process, The communication device according to claim 1.
4. The communication device according to claim 3, wherein the authentication information includes a pre-shared key and a data frame encryption key.
5. The communication device according to any one of claims 1, 3, or 4, wherein the subsystem has a state control unit that causes the main system to return to the normal state when an event occurs that the subsystem cannot process while the main system is in the power-saving state.
6. The communication device according to any one of claims 1, 3, or 4, wherein the power saving control unit causes the main system to switch to the power saving state after the main system or the subsystem has performed an authentication process for joining the network.
7. The communication device according to any one of claims 1, 3, or 4, wherein the network includes a wireless LAN network.
8. A communication method performed by a communication device including a main system capable of performing a first authentication process and a subsystem capable of performing a second authentication process, The aforementioned main system An authentication control step that causes the main system or subsystem to perform an authentication process for joining the network, The steps include: transitioning the main system to a power-saving state that consumes less power than the normal state in which the first authentication process can be executed; Execute, The subsystem is The steps include sending and receiving data via the aforementioned network, When the main system is in the power-saving state and a predetermined event related to connecting to the network occurs, the step of processing the predetermined event without returning the main system to the normal state is: Execute, The authentication control step causes the subsystem to execute the second authentication process, The aforementioned predetermined event includes an update process for the cryptographic key related to the second authentication process, Communication method.
9. A program executed by a communication device including a main system capable of performing a first authentication process and a subsystem capable of performing a second authentication process, In the aforementioned main system, An authentication control step that causes the main system or subsystem to perform an authentication process for joining the network, The steps include: transitioning the main system to a power-saving state that consumes less power than the normal state in which the first authentication process can be executed; Make it run, In the subsystem mentioned above, The steps include sending and receiving data via the aforementioned network, When the main system is in the power-saving state and a predetermined event related to connecting to the network occurs, the step of processing the predetermined event without returning the main system to the normal state is: Make it run, The authentication control step causes the subsystem to execute the second authentication process, The aforementioned predetermined event includes an update process for the cryptographic key related to the second authentication process, program.
10. A communication device including a main system and subsystems, A network interface that connects to a wireless network, A storage unit that stores the settings of one authentication method used by the communication device to connect to the wireless network, from among the multiple authentication methods for connecting to the wireless network, which include an authentication method that requires processing related to an electronic certificate and an authentication method that does not require processing related to an electronic certificate. It has, The aforementioned main system is A power-saving control unit, at a predetermined timing, switches the main system to a power-saving state that consumes less power than the normal state. It has, The subsystem described above is When the main system is in the power-saving state and receives a data frame for cryptographic key exchange via the wireless network, an event processing unit causes the main system or the subsystem to perform cryptographic key exchange based on the data frame. It has, If the setting of the first authentication method configured in the storage unit is an authentication method that does not require processing related to electronic certificates, the event processing unit causes the subsystem to perform a key exchange of the encryption key based on the received data frame. If the setting of the first authentication method configured in the storage unit is an authentication method that requires processing related to electronic certificates, the event processing unit transitions the main system from the power-saving state to the normal state, transmits the received data frame to the main system, and causes the main system to perform a key exchange of the encryption key based on the received data frame. Communication device.
11. The aforementioned main system is A first authentication unit that executes a process related to key exchange of an encryption key based on the data frame transmitted from the event processing unit. It further possesses, The subsystem described above is A second authentication unit that executes a process related to key exchange of the cryptographic key based on the received data frame. The communication device according to claim 10, further comprising the above.